Security audit

etf-intent-gate

Security checks for vulnerabilities and agentic risk

Overview

The skill largely matches its ETF intent-gateway purpose, but it exposes raw financial user queries in logs and task context without clear privacy controls.

Review privacy handling before installing: raw user queries may contain sensitive financial intent, are logged, and are present in forward task context. Use locked dependency versions, restrict log access, set retention/redaction rules, and deploy with an intentional LLM provider configuration.

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (10)

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The document explicitly states that original user queries are retained in logs, but it does not pair that retention with a user-facing notice, minimization rule, masking standard, retention period, or access-control guidance. In a finance-oriented gateway, raw queries may contain sensitive personal, financial, or account-related information, so silent logging increases privacy and compliance risk.

Unpinned Dependencies

Low

Category: Supply Chain
Content: fastapi>=0.110 uvicorn>=0.29 pydantic>=2.6 pydantic-settings>=2.2
Confidence: 94% confidence
Finding: The dependency is specified with only a lower bound, so builds may resolve to different versions over time. This weakens supply-chain reproducibility and can silently introduce breaking changes or newly published vulnerable releases into the gateway component.

Unpinned Dependencies

Low

Category: Supply Chain
Content: fastapi>=0.110 uvicorn>=0.29 pydantic>=2.6 pydantic-settings>=2.2 httpx>=0.27
Confidence: 94% confidence
Finding: Using an unpinned uvicorn version makes deployments non-reproducible and increases supply-chain risk because future installs may pull unexpected releases. In a gateway service exposed to user traffic, unexpected dependency drift can affect availability or introduce security regressions.

Unpinned Dependencies

Low

Category: Supply Chain
Content: fastapi>=0.110 uvicorn>=0.29 pydantic>=2.6 pydantic-settings>=2.2 httpx>=0.27 python-dotenv>=1.0
Confidence: 93% confidence
Finding: An unpinned pydantic dependency allows version drift across environments, which can cause incompatible parsing behavior or bring in vulnerable transitive changes. For an intent-classification gateway that relies on structured validation, that increases operational and security uncertainty.

Unpinned Dependencies

Low

Category: Supply Chain
Content: fastapi>=0.110 uvicorn>=0.29 pydantic>=2.6 pydantic-settings>=2.2 httpx>=0.27 python-dotenv>=1.0 pytest>=8.0
Confidence: 93% confidence
Finding: The pydantic-settings package is not pinned, so installations may resolve to different releases over time. Configuration parsing changes or vulnerable upstream releases could alter security-sensitive runtime behavior in this gateway service.

Unpinned Dependencies

Low

Category: Supply Chain
Content: uvicorn>=0.29 pydantic>=2.6 pydantic-settings>=2.2 httpx>=0.27 python-dotenv>=1.0 pytest>=8.0
Confidence: 93% confidence
Finding: httpx is specified with a lower-bound only, which permits future versions to be installed without review. For a pre-dispatch gateway that may make outbound service calls, this creates unnecessary supply-chain and stability risk.

Unpinned Dependencies

Low

Category: Supply Chain
Content: pydantic>=2.6 pydantic-settings>=2.2 httpx>=0.27 python-dotenv>=1.0 pytest>=8.0
Confidence: 96% confidence
Finding: python-dotenv is not pinned, which already creates dependency drift risk, and the file also indicates version 1.0 has published advisories. In a service that may consume environment-based secrets and configuration, vulnerable dotenv handling can directly affect confidentiality or file integrity.

Unpinned Dependencies

Low

Category: Supply Chain
Content: pydantic-settings>=2.2 httpx>=0.27 python-dotenv>=1.0 pytest>=8.0
Confidence: 95% confidence
Finding: pytest is unpinned, allowing vulnerable or incompatible releases to be installed unpredictably in development or CI. While primarily a test dependency, compromised test tooling can affect pipelines, artifacts, and developer environments.

Known Vulnerable Dependency: python-dotenv==1.0 — 2 advisory(ies): CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via ); CVE-2026-28684 (python-dotenv reads key-value pairs from a .env file and can set them as environ)

Medium

Category: Supply Chain
Confidence: 82% confidence
Finding: The finding reports python-dotenv 1.0 with advisories involving symlink-following and environment file handling. If this project actually installs or resolves to the affected version and uses vulnerable code paths such as writing .env values, an attacker could potentially overwrite arbitrary files or abuse configuration loading behavior.

Known Vulnerable Dependency: pytest==8.0 — 2 advisory(ies): CVE-2025-71176 (pytest has vulnerable tmpdir handling); CVE-2025-71176 (pytest has vulnerable tmpdir handling)

High

Category: Supply Chain
Confidence: 78% confidence
Finding: The finding indicates pytest 8.0 is affected by a tmpdir handling vulnerability. This mainly impacts test and CI contexts rather than runtime production traffic, but in shared runners or untrusted test scenarios it could enable file-system abuse or compromise build integrity.

Static analysis

No suspicious patterns detected.